Business Administration, Compliance and Legal Affairs
Purpose and Personal Data Processed / Description / Lawful Basis
Business administration and legal compliance
Identity Data
Contact Data
Profile Data
Usage Data
Technical Data
Incident Data
Communications Data
Recruitment Data
Professional Data
To comply with our legal obligations. To enforce our legal rights or defend against potential legal claims. To protect the rights of third parties. To facilitate a business transition such as a merger, reorganisation, acquisition by another company, or sale of any of our assets. Legitimate interests – to operate our business effectively. Compliance with a legal obligation.
Security
Identity Data
Contact Data
Image Data
To implement and manage physical security measures. Security measures are in place at our premises, including CCTV and building access controls. There are signs in place showing that CCTV is in operation. The images captured are securely stored and only accessed on a need-to-know basis (e.g. to look into an incident). CCTV recordings are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft). Visitors to our premises may be required to sign in on arrival and where that is the case, we will keep a record of visitors for a short period of time. Our visitor records are securely stored and only accessible on a need-to-know basis (e.g. to look into an incident).Legitimate interests – to keep our premises secure and provide a safe environment for our personnel and visitors to our premises.
Health, Safety and Incidents
Identity Data
Contact Data
Profile Data
Incident Data
To report or manage a health and safety or other type of incident that occurs at our premises or at one of our events. Compliance with a legal obligation. Legitimate interests – to effectively manage an incident, including to assess our handling of an incident to help us improve our processes. Necessary to protect vital interests.
-------------------------------------------------------------------------------------------------------------
K3 Advisory Group
Recruitment Privacy Policy
Effective from: 16 October 2026
1. About this Policy
This K3 Advisory Group Recruitment Privacy Policy (“Recruitment Policy”) explains how the K3 Advisory group of companies (the “K3 Advisory Group”) collects and uses your personal data when you apply for, or are considered for, a role with us.
A full list of the companies in the K3 Advisory Group, including their registered offices and ICO registration numbers, is set out in the K3 Advisory Group Privacy Policy (“Group Policy”), available at https://k3advisorygroup.com/privacy-policy/ or on request.
This Recruitment Policy applies to people who apply for a role with us, who connect with us to hear about opportunities, whose details we are provided by third parties or public sources because we believe their profile is of interest, and to people listed as a referee (a “Candidate” / “you” / “your”).
This Recruitment Policy supplements the wider Group Policy and takes priority in relation to recruitment.
This Recruitment Policy also explains the limited use of artificial intelligence in our application review and shortlisting process.
2. Who is responsible for your personal data
Where this Privacy Policy refers to the “K3 Advisory Group”, “we”, “us”, “our”, this means any or all of the companies in the K3 Advisory Group which will process your personal data.
For the purpose of EU and UK data protection legislation, except as stated otherwise, where applicable, each company in the K3 Advisory Group which receives your personal data will act as an independent data controller.
We manage our employer branding and recruitment through our career site and a related applicant tracking system provided by Teamtailor AB (registered in Sweden under company number 556936-6668).
3. How to contact us
For any question about this Policy or about how we process your personal data in connection with recruitment, or to exercise your rights, you can:
a. email our Recruitment team at hrandrecruitment@k3advisorygroup.com;
b. email our Data Protection Office at dataprotection@k3advisorygroup.com; or
c. write to us at: Data Protection Office, K3 Advisory Group, K3 House, 5 Springfield Court, Summerfield Road, Bolton, England, BL3 2NT.
4. The personal data we collect
Depending on how you interact with us, we may process the following categories of personal data:
a. Device and technical data – your IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, approximate geographic location, operating system and device settings, and information about the pages you visit and your activity on the career site;
b. Contact details – your name, email address, telephone number and postal address;
c. Application information – the information in your CV, covering letter, application form, work samples, assessment responses, education, qualifications, skills and work history;
d. Recruitment process information – interview notes, assessments and test results, salary expectations and related correspondence;
e. Eligibility information – information needed to confirm your right to work and identity, such as your passport, identity documents and relevant governmental identifiers;
f. Public profile information – information from public sources relating to your professional experience, such as LinkedIn or your current employer's website;
g. Reference information – information provided by referees or by employees or partners who refer you; and
h. Communications data – the content of your communications with us, including emails, messages and, where you consent, interview recordings.
We ask you not to include special category data (such as information revealing health, disability, race, ethnicity, religion, sexual orientation or trade union membership) or criminal offence data in your application unless we specifically request it.
Where you provide such data, or where it is necessary for us to process it (for example, to make reasonable adjustments or to meet our legal obligations), we will rely on an appropriate condition under Article 9 of the UK GDPR or the Data Protection Act 2018. Equality-monitoring information is collected separately, is kept confidential and is not used to make recruitment decisions or provided to any AI tool.
5. Where we obtain your personal data
We obtain personal data directly from you, from your use of our career site(s), from public sources, from referees, from recruitment agencies and partners, and from information we or our interviewers create during the recruitment process.
6. How and why we use your personal data
We process your personal data to:
a. assess your suitability and eligibility for roles you apply for or are considered for;
b. communicate with you about your application and about current and future opportunities;
c. organise and conduct interviews, assessments and, where you consent, record interviews;
d. obtain and evaluate references;
e. operate, secure, analyse and improve our career site;
f. keep records of our recruitment activity;
g. comply with our legal and regulatory obligations, including equal opportunities obligations; and
h. establish, exercise or defend legal claims.
7. Use of AI
We may use approved artificial intelligence tools (“AI”), specifically “Claude” through Anthropic Ireland, Limited (registered in Ireland under company number: 760497), to support our recruitment team.
AI is solely used to help us organise and summarise the information or evidence in a CV and/or application, in order to compare this against the predefined, job-related criteria for the role. It may indicate where supporting evidence appears to be present, absent or unclear.
AI does not make any decision about whether a Candidate is shortlisted, rejected, interviewed or appointed. This will always ultimately require a human decision through our recruitment team, meaning that we do not make decisions based solely on automated processing.
We will minimise or remove identifiers and/or the data collected to the extent strictly necessary for the recruitment process.
We do not provide equality-monitoring, special category or criminal offence data to AI for decision-making purposes or to assess or infer your health, disability, race or ethnicity, religion or belief, sexual orientation, gender identity, personality, emotions or trustworthiness.
You may ask for more information about the role of AI in our process, ask us to review the accuracy of any output, request a reasonable adjustment, or ask that your application be considered through an alternative, non-AI route. To do so, please contact us using the details provided above.
8. Lawful bases for processing
The lawful bases on which we rely are:
a. Legitimate interests – our legitimate interest in the recruitment of an appropriate Candidate with the relevant competence(s), and in running a fair, consistent and efficient recruitment process (including the limited use of AI described in this Recruitment Policy), having assessed that these interests are not overridden by a Candidate’s own interests and rights;
b. Steps towards a contract – where processing is necessary to take steps at your request before entering into an employment contract;
c. Legal obligation – where we must process your data to comply with our legal and regulatory obligations, such as confirming your right to work; and
d. Consent – for certain activities only, such as recording an interview, contacting you about future vacancies, or obtaining special category data where appropriate. Where we rely on consent, it is optional, it is not bundled with your application, and you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
We do not rely on the tick-box acknowledgement that you have read this Policy as a lawful basis for assessing your application.
9. Who we share your personal data with
We share your personal data only where we are permitted to do so, and under appropriate contractual and security arrangements, with:
a. other companies in the K3 Advisory Group involved in the recruitment process;
b. our service providers, including Teamtailor AB and Claude, who act as our processors on our documented instructions;
c. recruitment agencies and providers that assist us or carry out background checks on our behalf;
d. our professional advisers, including lawyers and auditors;
e. authorities, regulators and other public bodies where we are legally required to do so; and
f. parties involved in a legal proceeding, or in a merger, acquisition or reorganisation.
10. International transfers
We aim to process your personal data within the UK and the EEA. Where your personal data is transferred outside the UK or the EEA, including by our service providers, we ensure an appropriate safeguard recognised by the GDPR is in place, such as an adequacy decision, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses (with the UK Addendum where relevant), together with appropriate technical and organisational measures. You may contact us for more information about the safeguards we use.
11. How long we keep your personal data
We keep your personal data only for as long as necessary, specifically being:
1. If you are a visitor to our careers page(s), we keep your data for one (1) year for security purposes.
2. If you connect with us to create a profile and receive information about current or future vacancies, we keep your data for as long as you remain connected with us. Your rights to the deletion of this data is set out below.
3. If you apply for a role but you are not successful, we keep your data for 12 months so that we can consider you for future opportunities, after which it is securely deleted.
4. If you are a referee, we keep your data for as long as we keep the data of the Candidate for whom you acted.
5. Records of AI-assisted review, including prompts, inputs and outputs, are kept only for the relevant recruitment, legal, regulatory and audit period in accordance with our recruitment retention schedule, and temporary or duplicate copies are deleted when no longer required.
If you are hired, we will keep your data in accordance with the privacy information provided to you as an employee.
12. Your rights
You have the following rights in relation to your personal data, subject to the conditions and exemptions in the GDPR:
1. the right to be informed about how we use your data;
2. the right to access your data and to receive a copy of it;
3. the right to rectification of inaccurate or incomplete data;
4. the right to erasure in certain circumstances;
5. the right to restrict processing in certain circumstances;
6. the right to data portability in certain circumstances;
7. the right to object to processing based on our legitimate interests, by reference to your particular situation;
8. the right to withdraw consent where we rely on it; and
9. the right to request information about, and human review of, any AI-assisted processing described in clause 7.
To exercise any of these rights or if you have any questions or requests in relation to the processing of your personal data, please contact us using the details above.
You also have the right to complain to the Information Commissioner's Office. Its contact details are available at https://ico.org.uk. We would, however, welcome the chance to address your concerns before you approach the ICO.
13. If you do not provide your personal data
Where we need your personal data to assess your application or to comply with a legal obligation and you do not provide it, we may be unable to progress your application.
14. Changes to this Policy
We may update this Policy from time to time. The latest version will be available on our career site(s), and we will indicate the date from which it is effective at the top of this Policy.
